When migrating a computer from NT 4 domain, the computer is a member of the Domain Users group, not (NETIQKB28472)

fact
Domain Migration Administrator 7.x

symptom
When migrating a computer from NT 4 domain, the computer is a member of the Domain Users group, not the Domain Computers group.

cause

Domain Migration Administrator (DMA) attempts to update the group membership of any object it migrates. In an NT 4 domain, the computers are actually included in the Domain Users group.  They just are not displayed in User Manger for Domains. When accounts are migrated, DMA adds all accounts to the Domain Users group. DMA then tries to add the computers to the Domain Computers group.  If this succeeds it tries to set the primaryGroup to be Domain Computers.  Then it removes the computer from the Domain Users group.

1. If any of these tasks fail, it is possible that the computers are left in the Domain Users group.
   
2. If you migrate the Domain Users group with DMA after migrating the computer, the computer will be added to the Domain Users group. 

fix

Refer to the following possible resolutions:

1. Grant the account being used for migration permissions to update group membership of the Domain Computers group.
   
2. Migrate the Domain Users group before you migrate any computers.  After migrating computers, do not migrate the Domain Users group.
   
3. Migrate the Domain Users group without updating its group membership.
   
1. Launch the Migrate Groups wizard.
   
2. Select the Domain Users group and continue through the wizard.
   
3. Click the Advanced on the Group Options screen.
   
4. Move the slider to Fast.  This will result in DMA will having a mapping of the Domain Users group for security translations, but no additional members (users or computers) will be added to the target Domain Users group.

Formerly known as NETIQKB28472